Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

702 results · page 7 of 15

Oct 10, 2025The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks.CVE-2025-52647 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.1
The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks.
Product
BigFix WebUI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0.CVE-2025-52635 · Other software · HCL · reported by psirt@hcl.comLow 3.7
A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION.CVE-2025-52625 · Other software · HCL · reported by psirt@hcl.comLow 3.7
A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025A vulnerability Bypass of the script allowlist configuration in HCL AION.CVE-2025-52624 · Other software · HCL · reported by psirt@hcl.comMedium 5.4
A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of cross-site scripting and other injection-based attacks.This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0CVE-2025-52650 · Other software · HCL · reported by psirt@hcl.comHigh 8.2
Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0
Product
HCL AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0.CVE-2025-52634 · Other software · HCL · reported by psirt@hcl.comLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0.
Product
HCL AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-52632 · Other software · HCL · reported by psirt@hcl.comMedium 6.5
A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-52630 · Other software · HCL · reported by psirt@hcl.comLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.
Product
AION
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 10, 2025Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics.CVE-2025-52655 · Other software · HCL · reported by psirt@hcl.comLow 3.1
Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics. v6.6 allows Loading third-party scripts without integrity checks or validation can allow external code run in the application's context, risking data exposure.
Product
HCL MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 3, 2025HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited.CVE-2025-52658 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited.
Product
MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 3, 2025HCL MyXalytics: 6.6.CVE-2025-52656 · Other software · HCL · reported by psirt@hcl.comHigh 7.6
HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields.
Product
HCL MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 3, 2025HCL MyXalytics v6.6 is affected by an HTML Injection.CVE-2025-52654 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially allowing unauthorized content injection and manipulation.
Product
HCL MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 3, 2025HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application.CVE-2025-52653 · Other software · HCL · reported by psirt@hcl.comHigh 7.6
HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorized scripts, potentially resulting in unauthorized actions or access.
Product
HCL MyXalytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Sep 3, 2025A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.CVE-2025-0280 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.5
A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.
Product
Compass
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 28, 2025AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability.CVE-2025-31971 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.1
AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability. The issue may allow attackers to launch a server-side request forgery (SSRF) attack enabling unauthorized network calls from the system, potentially exposing internal services or sensitive information.
Product
AIML Solutions for SX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 28, 2025A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions dCVE-2025-31979 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions during the upload process. An attacker may exploit this flaw to upload malicious or unauthorized files, such as scripts, executables, or web shells, by bypassing client-side or server-side validation mechanisms.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 28, 2025HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms.CVE-2025-31977 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 28, 2025HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker uCVE-2025-31972 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.
Product
BigFix Service Management (SM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 19, 2025HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access.CVE-2025-31988 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.9
HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access.
Product
Digital Experience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 15, 2025HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning.CVE-2025-52621 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache poisoning.
Product
BigFix SaaS Remediate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 15, 2025HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability.CVE-2025-52620 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.3
HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. The image upload functionality inadequately validated the submitted image format.
Product
BigFix SaaS Remediate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 15, 2025HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure.CVE-2025-52619 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages disclose sensitive version information about the underlying platform.
Product
BigFix SaaS Remediate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 15, 2025HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability.CVE-2025-52618 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.3
HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability. The vulnerability allows potential attackers to manipulate SQL queries.
Product
BigFix SaaS Remediate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 15, 2025HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.CVE-2025-31961 · Other software · HCL Software · reported by psirt@hcl.comLow 3.7
HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.
Product
Connections
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Aug 14, 2025HCL Connections Docs may mishandle validation of certain uploaded documents leading to denial of service due to resource exhaustion.CVE-2025-31987 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.8
HCL Connections Docs may mishandle validation of certain uploaded documents leading to denial of service due to resource exhaustion.
Product
Connections Docs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jul 29, 2025Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information oCVE-2025-31965 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.2
Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.
Product
BigFix Remote Control
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jul 24, 2025HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could increase exposure toCVE-2025-0253 · Other software · HCL Software · reported by psirt@hcl.comLow 2
HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could increase exposure to potential vulnerabilities.
Product
IEM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jul 24, 2025HCL IEM is affected by a password in cleartext vulnerability.CVE-2025-0252 · Other software · HCL Software · reported by psirt@hcl.comLow 2.6
HCL IEM is affected by a password in cleartext vulnerability. Sensitive information is transmitted without adequate protection, potentially exposing it to unauthorized access during transit.
Product
IEM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jul 24, 2025HCL IEM is affected by a concurrent login vulnerability.CVE-2025-0251 · Other software · HCL Software · reported by psirt@hcl.comLow 2.6
HCL IEM is affected by a concurrent login vulnerability. The application allows multiple concurrent sessions using the same user credentials, which may introduce security risks.
Product
IEM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jul 24, 2025HCL IEM is affected by an authorization token sent in cookie vulnerability.CVE-2025-0250 · Other software · HCL Software · reported by psirt@hcl.comLow 2.2
HCL IEM is affected by an authorization token sent in cookie vulnerability. A token used for authentication and authorization is being handled in a manner that may increase its exposure to security risks.
Product
IEM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jul 24, 2025HCL IEM is affected by an improper invalidation of access or JWT token vulnerability.CVE-2025-0249 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers to access sensitive data without authorization.
Product
IEM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jul 24, 2025HCL iAutomate is affected by a sensitive data exposure vulnerability.CVE-2025-31955 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.6
HCL iAutomate is affected by a sensitive data exposure vulnerability. This issue may allow unauthorized access to sensitive information within the system.
Product
iAutomate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jul 24, 2025HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unauthorized parties.CVE-2025-31953 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.1
HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unauthorized parties.
Product
iAutomate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jul 24, 2025HCL iAutomate is affected by an insufficient session expiration.CVE-2025-31952 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.1
HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access.
Product
iAutomate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Jul 17, 2025HCL Connections is vulnerable to an information disclosure vulnerability that could allow a user to obtain sensitive information they are not entitled to, whichCVE-2024-42209 · Other software · HCL Software · reported by psirt@hcl.comLow 3.5
HCL Connections is vulnerable to an information disclosure vulnerability that could allow a user to obtain sensitive information they are not entitled to, which is caused by improper handling of request data.
Product
Connections
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 30, 2025HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application witCVE-2024-42191 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
Product
HCL Traveler for Microsoft Outlook (HTMO)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 30, 2025HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application witCVE-2024-42190 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
Product
HCL Traveler for Microsoft Outlook (HTMO)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 30, 2025Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data using brute-force or dictionary attacks efficiently using modernCVE-2024-23589 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.8
Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data using brute-force or dictionary attacks efficiently using modern hardware such as GPUs or ASICs
Product
HCL Glovius Cloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 5, 2025HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment.CVE-2024-42213 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment. An attacker might gain access to these files by indexing or retrieved via predictable URLs or misconfigured permissions, leading to information disclosure.
Product
HCL BigFix Compliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
May 5, 2025HCL BigFix Compliance is affected by an improper or missing SameSite attribute.CVE-2024-42212 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery (CSRF) attacks, where a malicious site could trick a user's browser into making unintended requests using authenticated sessions.
Product
HCL BigFix Compliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 30, 2025Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem.CVE-2024-30146 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.1
Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem.
Product
HCL Domino Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 30, 2025Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications.CVE-2024-30145 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications.
Product
HCL Domino Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 30, 2025Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.CVE-2024-30115 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.3
Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.
Product
HCL Domino Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 30, 2025Insufficient default configuration in HCL Leap allows anonymous access to directory information.CVE-2023-45721 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
Insufficient default configuration in HCL Leap allows anonymous access to directory information.
Product
HCL Domino Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 30, 2025Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters.CVE-2023-37535 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.1
Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters.
Product
HCL Domino Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 30, 2025Missing "no cache" headers in HCL Leap permits sensitive data to be cached.CVE-2023-37517 · Other software · HCL Software · reported by psirt@hcl.comLow 3.2
Missing "no cache" headers in HCL Leap permits sensitive data to be cached.
Product
HCL Domino Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 30, 2025Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.CVE-2022-42450 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.
Product
HCL Domino Volt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 30, 2025Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applicationsCVE-2022-42449 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications
Product
HCL Domino Volt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 30, 2025Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications.CVE-2022-27562 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications.
Product
HCL Domino Volt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 25, 2025HCL SX v21 is affected by usage of a weak cryptographic algorithm.CVE-2024-30152 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL SX v21 is affected by usage of a weak cryptographic algorithm. An attacker could exploit this weakness to gain access to sensitive information, modify data, or other impacts.
Product
HCL SX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.